Case Study
At a glance
The data landscape
Profile
Digital health provider powering virtual care
Hundreds of healthcare organizations on its platform
Health, personal and payment data
Environment
AWS, hundreds of accounts
Google Cloud, two organizations
Google Workspace, about 10,000 drives
Snowflake
Jira and Confluence
The challenge
An estate the security team could not see
Months without results. The discovery tool the provider already had produced nothing from AWS in four months, and scans in Google Cloud were not finishing.
No tags on unstructured data. Most unstructured data carried no tags, so the team could not say what a bucket held.
Incident response by hand. Without that picture, scoping any incident meant weeks of manual work.
An estate bigger than planned. The team had sized its data at 200 TB. The real figure was more than six times that.
“You guys can imagine, we're a little gun shy right now, because we haven't had success to date, so it takes some convincing.”
The provider's CISO
“It looks like me and my team sitting there up all night, every night, for weeks or months, trying to figure out the data that's in there.”
The provider's VP of Security Operations
Why Bedrock Data
Results in the first week
Serverless scanning in place
Scanners run inside the provider's own AWS and Google Cloud accounts. Each cloud was stood up in one working session.
Classification the same week
Health, personal and payment data was classified and mapped to who can reach it within the first week.
Fingerprinting across environments
Fingerprinting found the same data sitting in both staging and production.
Filters the team builds itself
The team can build its own views, such as sensitive data that is shared publicly.
Google Workspace coverage
About 10,000 drives classified alongside the two clouds.
Snowflake and SaaS
Snowflake is scanned daily, with Jira and Confluence in scope as well.
Results
A full picture within weeks
1.3 PB and 1.4 billion records in scope. Against the 200 TB the team expected, classified across both clouds.
Results the same week. Each cloud was scanning after one working session, with classification results that week.
Exposure found, with remediation the same day. Before any formal training, the team built a filter for publicly shared sensitive data. The largest finding was 4,593 files, and remediation started that day.
Sprawl it can see. Copies of the same data in staging and production now show up as matches.
Every data store is classified and mapped to who can reach it, so the team can see what an exposure involves and start acting on it the same day.
The vision
A daily checklist for exposure
“For us, it's more incident response, right? For me, it's like, hey. Pre-flight checklist every single day, what are my top 5?”
The provider's Director of Information Security
What's next
Where this is heading
The team is extending coverage across more of its SaaS tools and working toward revoking risky file sharing directly from Bedrock Data.
